Smartphones with Qualcomm Chip Share Private Information with US Chip-Maker

• hardened_malloc

  652 1,158 7.7 C

  Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability / integration over time.

  

> When a custom ROM, even a "degoogled" one, is made, you include a customized kernel and custom drivers, and the AGPS URLs are part of this "driver".

Thanks, that should be the top comment.

Both, Sony and Google, provide driver downloads for their smartphones[1][2].

In this case, the "de-Googled" OS (/e/OS) did exactly what it promised to do: removed all network connections made by Google, but not by Qualcomm or anybody else.

Since Pixel smartphones use Google's own chips (which are based on Samsung Exynos), they obviously don't make any connections to Qualcomm servers.

This blog post is clearly an ad for NitroPhone, which is simply a Google Pixel phone with a different open-source privacy OS pre-installed (GrapheneOS[3]).

[1] https://developer.sony.com/develop/drivers/

[2] https://developers.google.com/android/drivers

[3] https://grapheneos.org/

• GmsCore

  429 7,013 9.5 Java

  Free implementation of Play Services

  

The initial HTTP request that they mention to Google is not related to Qualcomm at all but rather a part of the Google Play Services implementation in microG which /e/OS uses [1]. MicroG, as many might be aware, is an open-source implementation of Google Play Services that tries to avoid leaking sensitive user data amongst other things.

The request to android.clients.google.com though is required in order to checkin the device and receive a device ID and security token [2], which is needed for Firebase Cloud Messaging and push notifications [3]. The checkin include hardware details such as available features (GPS, WIFI, Microphone, EGL version) [4] but sensitive details such as HW MAC address, serial numbers and SIM operator ID are spoofed. [5, 6]

Basically if you're running deGoogled and still rely on Google Services, there _will_ be a few calls to Google owned servers. MicroG avoids sending sensitive HW and user data though, more can be read in this thread: https://github.com/microg/GmsCore/issues/1508

[1] https://doc.e.foundation/support-topics/micro-g

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

Suggest a related project